Embedded Discord CDN executable link bypasses anti-exe detection

[Rinzii]

xLuxy and I found what appears to be a gap in the anti-executable detection.

This pasted URL embeds successfully in Discord without being caught by the current executable check:

https://cdn.discordapp.com/attachments/1482689064544243803/1482952280717398108/Sidera_x64-setup-2.exe?ex=69b97b2f&is=69b829af&hm=e6453df4e6b09c8afb1f5691c3073d5fbbfd9143f812aae519dc45a464e754ea&

VirusTotal currently marks it as likely safe, but please still handle the file with care.

The linked file name is Sidera_x64-setup-2.exe.

Observed behavior

• Posting the URL above causes Discord to embed the linked file
• The anti-EXE check does not seem to block or flag it
• From looking at the current implementation, this appears to happen because the anti-executable module only checks file attachments and does not inspect links

Expected behavior

• If executable links are supposed to be disallowed, then direct-download links like this should also be handled
• At minimum, they should probably be flagged for review if they clearly point to an executable or other downloadable binary
• As it stands now, a linked executable can get around the current attachment-only check

Current understanding

• This does not seem to be a bug in the attachment scanning itself
• It looks more like a limitation of scope: the module checks attachments, but not links
• Because of that, a Discord CDN link to an .exe can pass through when sent as plain text and then embedded by Discord

Implementation note

• Checking links is a bit harder than checking attachments
• A simple HEAD request may not be reliable, depending on how the server responds
• Checking only for file extensions or keywords in the URL is also weak, since some download links may not include a useful filename
• Downloading linked content and checking magic bytes would be more accurate, but that may not be something we want to do for moderation or resource reasons

Suggested follow-up

• Decide whether executable links should be covered by anti-executable at all, or handled separately
• If they should be covered, it would help to document that the current module only checks attachments and then decide whether links should be flagged, blocked, or intentionally ignored